# Tensor-based Hardness of the Shortest Vector Problem to within Almost Polynomial Factors

We show that unless ⊆ (2^(n)), there is no polynomial-time algorithm approximating the Shortest Vector Problem () on n-dimensional lattices in the ℓ_p norm (1 ≤ p< ∞) to within a factor of 2^(n)^1- for any > 0. This improves the previous best factor of 2^(n)^1/2- under the same complexity assumption due to Khot (J. ACM, 2005). Under the stronger assumption ⊈, we obtain a hardness factor of n^c/n for some c> 0. Our proof starts with Khot's instances that are hard to approximate to within some constant. To boost the hardness factor we simply apply the standard tensor product of lattices. The main novelty is in the analysis, where we show that the lattices of Khot behave nicely under tensorization. At the heart of the analysis is a certain matrix inequality which was first used in the context of lattices by de Shalit and Parzanchevski (2006).

## Authors

• 15 publications
• 5 publications
02/15/2022

### Hardness of the (Approximate) Shortest Vector Problem: A Simple Proof via Reed-Solomon Codes

We give a simple proof that the (approximate, decisional) Shortest Vecto...
05/11/2020

### Approximate CVP_p in time 2^0.802 n

We show that a constant factor approximation of the shortest and closest...
05/24/2020

### A Note on the Concrete Hardness of the Shortest Independent Vectors Problem in Lattices

Blömer and Seifert showed that 𝖲𝖨𝖵𝖯_2 is NP-hard to approximate by givin...
06/24/2020

### Hardness of Approximation of (Multi-)LCS over Small Alphabet

The problem of finding longest common subsequence (LCS) is one of the fu...
11/12/2020

### Hardness of Approximate Nearest Neighbor Search under L-infinity

We show conditional hardness of Approximate Nearest Neighbor Search (ANN...
12/04/2017

### (Gap/S)ETH Hardness of SVP

We prove the following quantitative hardness results for the Shortest ...
04/10/2018

### Approximating Operator Norms via Generalized Krivine Rounding

We consider the (ℓ_p,ℓ_r)-Grothendieck problem, which seeks to maximize ...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

A lattice

is a periodic geometric object defined as the set of all integer combinations of some linearly independent vectors in

. The interesting combinatorial structure of lattices has been investigated by mathematicians over the last two centuries, and for at least three decades it has also been studied from an asymptotic algorithmic point of view. Roughly speaking, most fundamental problems on lattices are not known to be efficiently solvable. Moreover, there are hardness results showing that such problems cannot be solved by polynomial-time algorithms unless the polynomial-time hierarchy collapses. One of the main motivations for research on the hardness of lattice problems is their applications in cryptography, as was demonstrated by Ajtai [3], who came up with a construction of cryptographic primitives whose security relies on the worst-case hardness of certain lattice problems.

Two main computational problems associated with lattices are the Shortest Vector Problem () and the Closest Vector Problem (). In the former, for a lattice given by some basis we are supposed to find (the length of) a shortest nonzero vector in the lattice. The problem is an inhomogeneous variant of , in which given a lattice and some target point one has to find (its distance from) the closest lattice point. The hardness of lattice problems partly comes from the fact that there are many possible bases for the same lattice.

In this paper we improve the best hardness result known for . Before presenting our results let us start with an overview of related work.

### 1.1 Related work

In the early 1980s, Lenstra, Lenstra, and Lovász (LLL) [20] presented the first polynomial-time approximation algorithm for . Their algorithm achieves an approximation factor of , where is the dimension of the lattice. Using their algorithm, Babai [7] gave an approximation algorithm for achieving the same approximation factor. A few years later, improved algorithms were presented for both problems, obtaining a slightly sub-exponential approximation factor, namely  [31], and this has since been improved slightly [4, 26]. The best algorithm known for solving exactly requires exponential running time in  [18, 4, 26]. All the above results hold with respect to any norm ().

On the hardness side, it was proven in 1981 by van Emde Boas [32] that it is -hard to solve exactly in the norm. The question of extending this result to other norms, and in particular to the Euclidean norm , remained open until the breakthrough result by Ajtai [2] showing that exact in the norm is -hard under randomized reductions. Then, Cai and Nerurkar [10] obtained hardness of approximation to within for any . The first inapproximability result of to within a factor bounded away from is that of Micciancio [21], who showed that under randomized reductions in the norm is -hard to approximate to within any factor smaller than . For the norm, a considerably stronger result is known: Dinur [14] showed that is -hard to approximate in the norm to within a factor of for some constant .

To date, the strongest hardness result known for in the norm is due to Khot [19] who showed -hardness of approximation to within arbitrarily large constants under randomized reductions for any . Furthermore, under randomized quasipolynomial-time reductions (, reductions that run in time ), the hardness factor becomes for any . Khot speculated there that it might be possible to improve this to , as this is the hardness factor known for the analogous problem in linear codes [16].

Khot’s proof does not work for the norm. However, it was shown in [30] that for lattice problems, the norm is the easiest in the following sense: for any , there exists a randomized reduction from lattice problems such as and in the norm to the respective problem in the norm with essentially the same approximation factor. In particular, this implies that Khot’s results also hold for the norm.

Finally, we mention that a considerably stronger result is known for , namely that for any , it is -hard to approximate in the norm to within for some constant  [15]. We also mention that in contrast to the above hardness results, it is known that for any , and are unlikely to be -hard to approximate to within a factor, as this would imply the collapse of the polynomial-time hierarchy [17, 1].

### 1.2 Our results

The main result of this paper improves the best -hardness factor known for under randomized quasipolynomial-time reductions. This and two additional hardness results are stated in the following theorem. Here, is the randomized one-sided error analogue of . Namely, for a function we denote by the class of problems having a probabilistic algorithm running in time on inputs of size that accepts

inputs with probability at least

, and rejects inputs with certainty.

For every the following holds.

1. For every constant , there is no polynomial-time algorithm that approximates in the norm to within a factor of unless

 NP⊆RP=⋃c≥1RTIME(nc).
2. For every , there is no polynomial-time algorithm that approximates on -dimensional lattices in the norm to within a factor of unless

 NP⊆RTIME(2poly(logn)).
3. There exists a such that there is no polynomial-time algorithm that approximates on -dimensional lattices in the norm to within a factor of unless

 NP⊆RSUBEXP=⋂δ>0RTIME(2nδ).

Theoremthm:Intro improves on the best known hardness result for any . For , a better hardness result is already known, namely that for some , approximating to within is -hard [14]. Moreover, itemitm:intro_1 was already proved by Khot [19] and we provide an alternative proof. We remark that all three items follow from a more general statement (see Theoremthm:IntroGeneral).

### 1.3 Techniques

A standard method to prove hardness of approximation for large constant or super-constant factors is to first prove hardness for some fixed constant factor, and then amplify the constant using some polynomial-time (or quasipolynomial-time) transformation. For example, the tensor product of linear codes is used to amplify the -hardness of approximating the minimum distance in a linear code of block length to arbitrarily large constants under polynomial-time reductions and to (for any ) under quasipolynomial-time reductions [16]. This example motivates one to use the tensor product of lattices to increase the hardness factor known for approximating . However, whereas the minimum distance of the -fold tensor product of a code is simply the th power of the minimum distance of , the behavior of the length of a shortest nonzero vector in a tensor product of lattices is more complicated and not so well understood.

Khot’s approach in [19] was to prove a constant hardness factor for instances that have some “code-like” properties. The rationale is that such lattices might behave in a more predictable way under the tensor product. The construction of these “basic” instances is ingenious, and is based on BCH codes as well as a restriction into a random sublattice. However, even for these code-like lattices, the behavior of the tensor product was not clear. To resolve this issue, Khot introduced a variant of the tensor product, which he called augmented tensor product, and using it he showed the hardness factor of . This unusual hardness factor can be seen as a result of the augmented tensor product. In more detail, for the augmented tensor product to work, the dimension of Khot’s basic instances grows to , where denotes the number of times we intend to apply the augmented tensor product. After applying it, the dimension grows to and the hardness factor becomes . This limits the hardness factor as a function of the dimension to .

Our main contribution is showing that Khot’s basic instances do behave well under the (standard) tensor product. The proof of this fact uses a new method to analyze vectors in the tensor product of lattices, and is related to a technique used by de Shalit and Parzanchevski [13]. Theoremthm:Intro now follows easily: we start with (a minor modification of) Khot’s basic instances, which are known to be hard to approximate to within some constant. We then apply the -fold tensor product for appropriately chosen values of and obtain instances of dimension with hardness .

### 1.4 Open questions

Some open problems remain. The most obvious is proving that is hard to approximate to within factors greater than under some plausible complexity assumption. Such a result, however, is not known for nor for the minimum distance problem in linear codes, and most likely proving it there first would be easier. An alternative goal is to improve on the upper bound beyond which is not believed to be -hard [17, 1].

A second open question is whether our complexity assumptions can be weakened. For instance, our hardness result is based on the assumption that . For , such a hardness factor is known based solely on the assumption  [15]. Showing something similar for would be very interesting. In fact, coming up with a deterministic reduction (even for constant approximation factors) already seems very challenging; all known hardness proofs for in norms, , use randomized reductions. (We note, though, that [21] does describe a deterministic reduction based on a certain number-theoretic conjecture.) Ideas appearing in the recent -hardness proofs of the minimum distance problem in linear codes [11, 6] might be useful. Finally, we mention that a significant step towards derandomization was recently made by Micciancio [23]: he strengthened our results by showing reductions with only one-sided error.

### 1.5 Outline

The rest of the paper is organized as follows. In Sectionsec:preliminaries we gather some background on lattices and on the central tool in this paper—the tensor product of lattices. In Sectionsec:proof we prove Theoremthm:Intro. For the sake of completeness, Sectionappendix:Khot provides a summary of Khot’s work [19] together with the minor modifications that we need to introduce.

## 2 Preliminaries

### 2.1 Lattices

A lattice is a discrete additive subgroup of . Equivalently, it is the set of all integer combinations

 L(b1,…,bm)={m∑i=1xibi:xi∈Z for all 1≤i≤m}

of linearly independent vectors in . If the rank equals the dimension , then we say that the lattice is full-rank. The set is called a basis of the lattice. Note that a lattice has many possible bases. We often represent a basis by an matrix having the basis vectors as columns, and we say that the basis generates the lattice . In such case we write . It is well known and easy to verify that two bases and generate the same lattice if and only if for some unimodular matrix (, a matrix whose entries are all integers and whose determinant is ). The determinant of a lattice generated by a basis is . It is easy to show that the determinant of a lattice is independent of the choice of basis and is thus well-defined. A sublattice of is a lattice generated by some linearly independent lattice vectors . It is known that any integer matrix can be written as where has full column rank and is unimodular. One way to achieve this is by using the Hermite Normal Form (see, , [12, Page 67]).

For any , the norm of a vector is defined as and its norm is . One basic parameter of a lattice , denoted by , is the norm of a shortest nonzero vector in it. Equivalently, is the minimum distance between two distinct points in the lattice . This definition can be generalized to define the th successive minimum as the smallest such that contains linearly independent lattice points, where denotes the ball of radius centered at the origin. More formally, for any , we define

 λ(p)i(L)=min{r:dim(span(L∩Bp(r)))≥i}.

We often omit the superscript in when .

In 1896, Hermann Minkowski [28] proved the following classical result, known as Minkowski’s First Theorem. We consider here the norm, although the result has an easy extension to other norms. For a simple proof the reader is referred to [24, Chapter 1, Section 1.3].

[Minkowski’s First Theorem] For any rank- lattice ,

 det(L)≥(λ1(L)√r)r.

Our hardness of approximation results will be shown through the promise version , defined for any and for any approximation factor as follows.

[Shortest Vector Problem] An instance of is a pair , where is a lattice basis and is a number. In instances , and in instances .

### 2.2 Tensor product of lattices

A central tool in the proof of our results is the tensor product of lattices. Let us first recall some basic definitions. For two column vectors and of dimensions and respectively, we define their tensor product as the -dimensional column vector

 ⎛⎜ ⎜⎝u1v⋮un1v⎞⎟ ⎟⎠.

If we think of the coordinates of as arranged in an matrix, we obtain the equivalent description of as the matrix . More generally, any -dimensional vector can be written as an matrix . To illustrate the use of this notation, notice that if is the matrix corresponding to then

 ∥w∥22=tr(WWT). (1)

Finally, for an matrix and an matrix , one defines their tensor product as the matrix

 ⎛⎜ ⎜⎝A11B⋯A1m1B⋮⋮An11B⋯An1m1B⎞⎟ ⎟⎠.

Let be a lattice generated by the matrix and be a lattice generated by the matrix . Then the tensor product of and is defined as the -dimensional lattice generated by the matrix , and is denoted by . Equivalently, is generated by the vectors obtained by taking the tensor product of two column vectors, one from and one from . If we think of the vectors in as matrices, then we can also define it as

 L=L1⊗L2={B1XBT2:X∈\Zm1×m2},

with each entry in corresponding to one of the generating vectors. We will mainly use this definition in the proof of the main result.

As alluded to before, in the present paper we are interested in the behavior of the shortest nonzero vector in a tensor product of lattices. It is easy to see that for any and any two lattices and , we have

 λ(p)1(L1⊗L2)≤λ(p)1(L1)⋅λ(p)1(L2). (2)

Indeed, any two vectors and satisfy . Applying this to shortest nonzero vectors of and implies inequality eq:TensorLeq.

Inequality eq:TensorLeq has an analogue for linear codes, with replaced by the minimum distance of the code under the Hamming metric. There, it is not too hard to show that the inequality is in fact an equality: the minimal distance of the tensor product of two linear codes always equals to the product of their minimal distances. However, contrary to what one might expect, there exist lattices for which inequality eq:TensorLeq is strict. More precisely, for any sufficiently large there exist -dimensional lattices and satisfying

 λ1(L1⊗L2)<λ1(L1)⋅λ1(L2).

The following lemma due to Steinberg shows this fact. Although we do not use this fact later on, the proof is instructive and helps motivate the need for a careful analysis of tensor products. To present this proof we need the notion of a dual lattice. For a full-rank lattice , its dual lattice is defined as

 L∗={x∈\Rn:⟨x,y⟩∈\Z for all y∈L}.

A self-dual lattice is one that satisfies . It can be seen that for a full-rank lattice generated by a basis , the basis generates the lattice .

[[27, Page 48]] For any there exists an -dimensional self-dual lattice satisfying and .

We first show that for any full-rank -dimensional lattice , . Let be a lattice generated by a basis . Let be the basis generating its dual lattice . Now consider the vector . Using our matrix notation, this vector can be written as

 BIn((B−1)T)T=BB−1=In,

and clearly has norm . To complete the proof, we need to use the (non-trivial) fact that for any there exists a full-rank, -dimensional and self-dual lattice with shortest nonzero vector of norm . This fact is due to Conway and Thompson; see [27, Page 46] for details.

## 3 Proof of results

The following is our main technical result. As we will show later, Theoremthm:Intro follows easily by plugging in appropriate values of .

For any there exist such that the following holds. There exists a randomized reduction that takes as input a instance and an integer and outputs a instance of dimension with gap , where denotes the size of the instance. The reduction runs in time polynomial in and has two-sided error, namely, given a (resp., ) instance it outputs a (resp., ) instance with probability .

In fact, we will only need to prove this theorem for the case since, as is easy to see, the general case follows from the following theorem (applied with, say, ).111We note that our results can be shown directly for any without using Theoremthm:RosenRegev by essentially the same proof.

[[30]] For any , and there exists a randomized polynomial-time reduction from to , where .

### 3.1 Basic SVP

As already mentioned, our reduction is crucially based on a hardness result of a variant of stemming from Khot’s work [19]. Instances of this variant have properties that make it possible to amplify the gap using the tensor product. The following theorem summarizes the hardness result on which our proof is based. For a proof the reader is referred to Sectionappendix:Khot.

[[19]] There are a constant and a polynomial-time randomized reduction from to outputting a lattice basis , satisfying for some integer , and an integer , such that:

1. For any instance of , with probability at least , .

2. For any instance of , with probability at least , for every nonzero vector ,

• has at least nonzero coordinates, or

• all coordinates of are even and at least of them are nonzero, or

• all coordinates of are even and .

In particular, .

### 3.2 Boosting the SVP hardness factor

As mentioned before, we boost the hardness factor using the tensor product of lattices. For a lattice we denote by the -fold tensor product of . An immediate corollary of inequality eq:TensorLeq is that if is a instance of the variant in Theoremthm:Khot, and , then

 λ1(L⊗k)≤γkdk/2. (3)

For the case in which is a instance we will show that any nonzero vector of has norm at least , ,

 λ1(L⊗k)≥dk/2. (4)

This yields a gap of between the two cases. Inequality eq:NOinstances easily follows by induction from the central lemma below, which shows that instances “tensor nicely.”

Let be a instance of the variant given in Theoremthm:Khot, and denote by the lattice generated by the basis . Then for any lattice ,

 λ1(L1⊗L2)≥√d⋅λ1(L2).

The proof of this lemma is based on some properties of sublattices of instances which are established in the following claim.

Let be a instance of the variant given in Theoremthm:Khot, and let be a sublattice of rank . Then at least one of the following properties holds:

1. Every basis matrix of has at least nonzero rows (, rows that are not all zero).

2. Every basis matrix of contains only even entries and has at least nonzero rows.

3. .

Assume that does not have either of the first two properties. Our goal is to show that the third property holds. Since the first property does not hold, we have and also that any vector in has fewer than nonzero coordinates. By Theoremthm:Khot, this implies that . By the assumption that the second property does not hold, there must exist a basis of that has fewer than nonzero rows. Therefore, all nonzero vectors in have fewer than nonzero coordinates, and hence have norm at least , again by Theoremthm:Khot. We conclude that , and by Minkowski’s First Theorem (Theoremthm:mink_first) and we have

 det(L)≥(λ1(L)√r)r≥dr/2.\qedhere

[Proof of Lemmalem:NOinstances] Let be an arbitrary nonzero vector in . Our goal is to show that . We can write in matrix notation as , where the integer matrix is a basis of , is a basis of , and is an integer matrix of coefficients. Let be a unimodular matrix for which , where is a matrix with full column rank. Thus, the vector can be written as . Since is also unimodular, the matrices and generate the same lattice. Now remove from the columns corresponding to the zero columns in and denote the resulting matrix by . Furthermore, denote the matrix by . Observe that both of the matrices and are bases of the lattices they generate, , they have full column rank. The vector equals , where and .

Claimclaim:sublattice guarantees that the lattice defined above has at least one of the three properties mentioned in the claim. We show that in each of these three cases. Then, by the fact that , the lemma will follow.

Case 1:

Assume that at least of the rows in the basis matrix are nonzero. Thus, at least of the rows of are nonzero lattice points from , and thus

 ∥v∥2≥√d⋅λ1(L′2).
Case 2:

Assume that the basis matrix contains only even entries and has at least nonzero rows. Hence, at least of the rows of are even multiples of nonzero lattice vectors from . Therefore, every such row has norm at least , and it follows that

 ∥v∥2≥√d4⋅2⋅λ1(L′2)=√d⋅λ1(L′2).

The third case is based on the following central claim, which is similar to Proposition 1.1 in [13]. The proof is based on an elementary matrix inequality relating the trace and the determinant of a symmetric positive semidefinite matrix (see, , [9, Page 47]).

Let and be two rank- lattices generated by the bases and respectively. Consider the vector in , which can be written as in matrix notation. Then,

 ∥v∥2≥√r⋅(det(L1)⋅det(L2))1/r.

Define the two symmetric positive definite matrices and (known as the Gram matrices of and ). By the fact that for any matrices and and by equation eq:normastrace,

 ∥v∥22=tr((UWT)(UWT)T)=tr(G1G2)=tr(G1G1/22G1/22)=tr(G1/22G1G1/22),

where is the positive square root of . The matrix is also symmetric and positive definite, and as such it has

real and positive eigenvalues. We can thus apply the inequality of arithmetic and geometric means on these eigenvalues to get

 ∥v∥22=tr(G)≥rdet(G)1/r=r⋅(det(G1)⋅det(G2))1/r.

Taking the square root of both sides of this equation completes the proof.

Equipped with Claimclaim:DeShalitType we turn to deal with the third case. In order to bound from below the norm of , we apply the claim to its matrix form with the lattices and as above.

Case 3:

Assume that the lattice satisfies , where denotes its rank. Combining Claimclaim:DeShalitType and Minkowski’s First Theorem we have that

 ∥v∥2≥√r⋅(det(L′1)⋅det(L′2))1/r≥√r⋅(dr/2)1/r⋅λ1(L′2)√r=√d⋅λ1(L′2),

and this completes the proof of the lemma.

### 3.3 Proof of the main theorem

[Proof of Theoremthm:IntroGeneral] Recall that it suffices to prove the theorem for . Given a instance of size , we apply the reduction from Theoremthm:Khot and obtain in time a pair where is a basis of a -dimensional lattice. We then output , where is the -fold tensor product of , , a basis of the lattice . The dimension of this lattice is , and combining inequalities eq:YESinstances and eq:NOinstances we infer a gap of .

[Proof of Theoremthm:Intro] For itemitm:intro_1, choose to be a sufficiently large constant and apply Theoremthm:IntroGeneral. This shows that any constant factor approximation algorithm to implies a two-sided error algorithm for . Using known self-reducibility properties of (see, , [29, Chapter 11]), this also implies a one-sided error polynomial-time algorithm for . For itemitm:intro_2, apply Theoremthm:IntroGeneral with (where is the size of the input instance) and let be the dimension of the output lattice. Since

 k=(logNC)11+ε>(logNC)1−ε,

the gap we obtain as a function of the dimension is . Therefore, an algorithm that approximates better than this gap implies a randomized algorithm running in time , and hence the desired containment . Itemitm:intro_3 follows similarly by applying Theoremthm:IntroGeneral with for all .

## 4 Proof of Theoremthm:Khot

In this section we prove Theoremthm:Khot. The proof is essentially the same as the one in [19] with minor modifications.

### 4.1 Comparison with Khot’s theorem

For the reader familiar with Khot’s proof, we now describe how Theoremthm:Khot differs from the one in [19]. First, our theorem is only stated for the norm (since we use Theoremthm:RosenRegev to extend the result to other norms). Second, the instances of Khot had another property that we do not need here (namely, that the coefficient vector of the short lattice vector is also short). Third, as a result of the augmented tensor product, Khot’s theorem includes an extra parameter that specifies the number of times the lattice is supposed to be tensored with itself. Since we do not use the augmented tensor product, we simply fix to be some constant. In more detail, we choose the number of columns in the BCH code to be , as opposed to . This eventually leads to our improved hardness factor. Finally, the third possibility in our case is different from the one in Khot’s theorem (which says that there exists a coordinate with absolute value at least ). We note that coordinates with huge values are used several times in Khot’s construction in order to effectively restrict a lattice to a subspace. We instead work directly with the restricted lattice, making the reduction somewhat cleaner.

### 4.2 The proof

The proof of Theoremthm:Khot proceeds in three steps. In the first, a variant of the Exact Set Cover problem, which is known to be -hard, is reduced to a gap variant of . In the second step we construct a basis of a lattice which, informally, contains many short vectors in the case, and few short vectors in the case. Finally, in the third step we complete the reduction by taking a random sublattice.

#### 4.2.1 Step 1

First, consider the following variant of Exact Set Cover. Let be an arbitrarily small constant. An instance of the problem is a pair , where is a collection of subsets of some universe , and is a positive integer. In instances, there exists of size that covers each element of the universe exactly once. In instances, there is no of size less than that covers all elements of the universe. This problem is known to be -hard for an arbitrarily small and for  [8]. Moreover, it is easy to see that the problem remains -hard if we fix to be any negative power of and restrict to be a power of . Thus, to prove Theoremthm:Khot, it suffices to reduce from this problem.

In the first step we use a well-known reduction from the above variant of Exact Set Cover to a variant of . For an instance we identify with the matrix over whose columns are the characteristic vectors of the sets in . The reduction outputs an instance , where is a basis generating the lattice and is some integer vector satisfying . (If no such exists, the reduction outputs an arbitrary instance.) We note that given the basis can be constructed in polynomial time (see, , [22, Lemma 3.1]).

If is a instance of the above variant of Exact Set Cover, then there is a lattice vector such that is a vector and has exactly coordinates equal to . If is a instance, then for any lattice vector and any nonzero integer , the vector has at least nonzero coordinates.

If is a instance then there exists a vector with exactly coordinates equal to for which . This implies that , so is the required lattice vector. On the other hand, if is a instance, then for any we have . This implies that the nonzero coordinates of correspond to a cover of all elements in , and hence their number must be at least .

#### 4.2.2 Step 2

The second step of the reduction is based on BCH codes, as described in the following theorem.

[[5, Page 255]] Let be integers satisfying . Then there exists an efficiently constructible matrix of size with entries such that the rows of the matrix are linearly independent over and any columns of the matrix are linearly independent over .

Let be a basis of the lattice . Such a basis can be easily constructed in polynomial time by duality (see the preliminaries in [25]). The next lemma states some properties of this lattice.

Every nonzero vector in either has at least nonzero coordinates or all of its coordinates are even. Also, for any it is possible to find in polynomial time with probability at least a vector , such that there are at least

 1100⋅2h(Nr)

distinct lattice vectors satisfying that is a vector with exactly coordinates equal to .

Let be a nonzero lattice vector. Observe that if

has an odd coordinate then its odd coordinates correspond to column vectors of

that sum to the zero vector over . Therefore, their number must be at least . This proves the first statement.

We now prove the second statement. Consider the set whose size is (since as a subset of it is the kernel of whose dimension is ). In order to choose we first uniformly pick a vector in this set and then we uniformly pick of its coordinates and flip them. For a vector let denote the number of ways in the above process to obtain among the possible ways. The probability that the chosen satisfies

 As≤1100⋅2h(Nr)is∑s% s.t. As≤1100⋅2h(Nr)As2N−h(Nr)≤2N⋅1100⋅2h(Nr)2N−h(Nr)≤1100,

thus with probability at least we obtain an that satisfies

 As>1100⋅2h(Nr).

It remains to notice that such an also satisfies the requirement in the statement of the lemma (since from each vector in of Hamming distance from we can obtain as in the statement by simply adding to a subset of its coordinates).

We now construct the intermediate lattice generated by a basis matrix (see Figurefig:bint). Let be a sufficiently small constant, say . Let and choose as in Lemmalemma:L_BCH. We choose the parameters of to be , , and . Consider a matrix whose upper left block is , whose lower right block is , and whose other entries are zeros. Adding to this matrix the column given by the concatenation of and , we obtain the basis matrix of the intermediate lattice.

The following two lemmas describe the properties of . The first one states that if the instance is a instance then contains many short vectors. Define . A nonzero lattice vector of is called good if it has norm at most , has coordinates, and has at least one coordinate equal to .

If the instance is a instance and the vector has the property from Lemmalemma:L_BCH, then there are at least good lattice vectors in .

Assume that the instance is a instance. By Lemmalem:B_cvp, this implies that there exists such that is a vector and has exactly coordinates equal to . Let be as in Lemmalemma:L_BCH, so there are at least distinct choices of for which is a vector with exactly coordinates equal to . For every such , the lattice vector222We use to denote concatenation of vectors.

 Bint(y∘x∘(−1))=(2(BCVPy−t)∘((BBCH)x−s))

has coordinates, has at least one coordinate equal to , and has norm , as required.

The second lemma shows that if the instance is a instance then contains few vectors that do not have the property from Theoremthm:Khot, Item 2. We call such vectors annoying. In more detail, a lattice vector of is annoying if it satisfies all of the following:

• The number of its nonzero coordinates is smaller than .

• Either it contains an odd coordinate or the number of its nonzero coordinates is smaller than .

• Either it contains an odd coordinate or it has norm smaller than .

If the instance is a instance, then there are at most annoying lattice vectors in .

Assume that the instance is a instance and let be an annoying vector with coefficient vector . We have

 Bintx=2(BCVPy+j0t)∘(BBCHz+j0s).

By Lemmalem:B_cvp, if then the vector has at least nonzero coordinates, so it is not an annoying vector. Thus we can assume that and therefore .

Since is annoying we know that it has fewer than nonzero coordinates, so by Lemmalemma:L_BCH we get that all coordinates of are even. Again by the definition of an annoying vector, we conclude that fewer than of the coordinates of are nonzero and all of them have absolute value smaller than . Thus, we get a bound of on the number of possible choices for , and this completes the proof of the lemma.

#### 4.2.3 Step 3

In the third step we construct the final instance as claimed in Theoremthm:Khot. By Lemmalemma:Good, the number of good vectors in the case is at least

 1100⋅2h(Nr)=1100⋅2(dlog2N)/2(N(3/4+η)d)≥N(3/4+η)d100⋅dd⋅Nd/2=N(1/4+η)d100⋅dd=:G.

By Lemmalemma:Annoying, in the case there are at most annoying vectors. By our choice of and the fact that , for sufficiently large we have and hence

 A≤dd/4⋅(2N)d/4≤10−5⋅G.

Choose a prime in the interval and let be a vector whose coordinates are chosen randomly and uniformly from the range . The final output of the reduction is a basis of the lattice .

If the instance is a instance and the vector has the property from Lemmalemma:L_BCH, then with probability at least over the choice of the vector , there exists a lattice vector in with norm at most .

If the instance is a instance and has the property from Lemmalemma:L_BCH, then by Lemmalemma:Good there are at least good vectors in , , vectors with norm at most , coordinates from , and at least one coordinate equal to . For each good vector , consider the event that . Since a good vector is nonzero, we clearly have that each such event occurs with probability . Moreover, observe that these vectors are pairwise linearly independent modulo and therefore these events are pairwise independent. Therefore, using Chebyshev’s Inequality, with probability at least , at least one of these events happens, and we are done.

If the instance is a instance, then with probability at least over the choice of the vector , for every nonzero lattice vector ,

• has at least nonzero coordinates, or

• all coordinates of are even and at least of them are nonzero, or

• all coordinates of are even and .

The probability that a nonzero lattice vector satisfies is . By the union bound, the probability that at least one of the annoying vectors of belongs to is at most . Therefore, with probability at least , no lattice vector in